DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability

Bugtraq ID:	19369
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 06 2006 12:00AM
Updated:	Aug 06 2006 11:51PM
Credit:	Luigi Auriemma is credited with the discovery of this vulnerability.
Vulnerable:	DConnect DConnect Daemon 0.7 DConnect DConnect Daemon 0.0.3 DConnect DConnect Daemon 0.0.2 DConnect DConnect Daemon CVS 30 Jul 2006
Not Vulnerable:	DConnect DConnect Daemon CVS 31 Jul 2006

DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability

DConnect Daemon is prone to a buffer-overflow vulnerability because the library fails to do proper boundary checks before copying user-supplied data into a finite-sized buffer.

This issue allows remote attackers to execute arbitrary code within the context of the application or cause the application to crash causing a denial of service.

Version 0.7.0, CVS July 30th 2006 and prior versions are vulnerable to this issue.

DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/DConnectExploitCodeAugust062006.ZIP

DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability

Solution:
The vendor has released an update to address this issue. Please contact the vendor for more information on how to obtain this updates.

DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability

References:

• DConnect Daemon Home Page (DConnect)